Pinned Tweet
First Rust contest.
First L1 contest.
First place.
I am really happy about this one! Tough competition, deep codebase and a lot learned along the way.
Big thanks to @citrea_xyz and @cantinaxyz for the opportunity 🔥
And huge shoutout to @tqkve and @AifosSi for the solid judging 🫡
The @Citrea_xyz competition results are in. 🪐
Researchers reviewed the first ZK rollup on Bitcoin L1.
Your top-ranked researchers:
🥇 @MartinMarchev: $21,071.01
🥈 @franfraneth: $9,780.99
🥉 @coachpetrus: $6,086.17
Thanks to everyone that contributed. Full leaderboard below.
Update: Immunefi upheld the duplicate closure.
Their own fix-bypass policy says a bug that wasn't effectively fixed should be reported.
That's exactly what I did. The PoC in my report still works after the attempted fix.
Yet their mediation response didn't even mention the fix-bypass policy.
So what's the point of having it?
Why would any whitehat spend time checking whether a fix actually works if the answer is still "duplicate, no reward"?
I thought Immunefi was supposed to keep this fair.
Instead, they're keeping their clients happy.
Projects trying to rug whitehats seem to be the norm lately.
I recently found a High severity bug. The project closed it as a duplicate of an earlier report. Which is technically true since both have the same root cause.
The funny part is they already tried to fix it.
And failed.
My PoC demonstrates that their fix can be bypassed and the bug is still exploitable.
@immunefi even has an explicit fix-bypass policy for cases like this:
immunefisupport.zendesk.com/…
But I guess it's easier to close the report than fix the bug and pay the whitehat.
Martin Marchev retweeted
In the era of AI-powered triage, paying more than $10–$20 just to report a bug is EV-negative for both sides.
I've been in this industry for years, on both sides of the table.
If processing a report costs you more than $20, that's a triage problem. Passing that cost on to researchers just rigs the process against them.
This was an issue when we first started the AI slop submissions, now it's not about that anymore, fix your triaging bots and ease your process for to the defending side!
I can't believe i have to write this, tbh, lol!
Projects trying to rug whitehats seem to be the norm lately.
I recently found a High severity bug. The project closed it as a duplicate of an earlier report. Which is technically true since both have the same root cause.
The funny part is they already tried to fix it.
And failed.
My PoC demonstrates that their fix can be bypassed and the bug is still exploitable.
@immunefi even has an explicit fix-bypass policy for cases like this:
immunefisupport.zendesk.com/…
But I guess it's easier to close the report than fix the bug and pay the whitehat.
Not sure what's sadder: finding a fund theft crit and getting duped...
Or realizing the whitehat who found it first missed the full impact.
I'm sorry for both of us, pal 💀
Martin Marchev retweeted
Update Telegram Desktop immediately!
A critical vulnerability has been discovered that allows attackers to gain access to your account and secretly steal files from your computer.
The attack uses links in the format tg://. If a special command is constructed, clicking the link can cause a malicious script to send a selected file to the attacker’s channel - without requiring additional confirmation.
Update: @immunefi refunded the full 95 USDC (both the Studio Review fee and the submission fee) and acknowledged the issue.
They are also looking into why Studio missed the duplicate.
Fair outcome and props for handling the feedback quickly!
I decided to give Immunefi Studio Review a shot before submitting a High severity finding.
The submission for this particular program costs $75 so I decided to pay $20 for a Studio review first to sanity-check the report.
Immunefi Studio came back with "Ready" - "meets standard escalation criteria with no blocking technical flaws".
To be fair, it suggested a couple of improvements to the PoC which I applied to the report before submitting.
So I paid the $75 and submitted.
15 minutes later, my favorite guy Andrew closed it as a duplicate of a report submitted 9 days earlier.
So that's $20 for Studio Review + $75 submission fee = $95 to have one Immunefi bot tell me "send it" and another Immunefi bot tell me "duplicate report".
That's the part I'm struggling with.
Immunefi Studio is explicitly advertised as checking duplicate risk too.
If a duplicate has already been sitting in your system for 9 days and the Review bot can't catch it, but the triage bot catches it almost immediately after submission, then what exactly is the value proposition here?
@immunefi / @MitchellAmador - I genuinely think this is useful feedback if you're still iterating on Immunefi Studio.
But from the whitehat side, this flow feels pretty broken.
Especially when it costs $95 to get to this outcome.
I decided to give Immunefi Studio Review a shot before submitting a High severity finding.
The submission for this particular program costs $75 so I decided to pay $20 for a Studio review first to sanity-check the report.
Immunefi Studio came back with "Ready" - "meets standard escalation criteria with no blocking technical flaws".
To be fair, it suggested a couple of improvements to the PoC which I applied to the report before submitting.
So I paid the $75 and submitted.
15 minutes later, my favorite guy Andrew closed it as a duplicate of a report submitted 9 days earlier.
So that's $20 for Studio Review + $75 submission fee = $95 to have one Immunefi bot tell me "send it" and another Immunefi bot tell me "duplicate report".
That's the part I'm struggling with.
Immunefi Studio is explicitly advertised as checking duplicate risk too.
If a duplicate has already been sitting in your system for 9 days and the Review bot can't catch it, but the triage bot catches it almost immediately after submission, then what exactly is the value proposition here?
@immunefi / @MitchellAmador - I genuinely think this is useful feedback if you're still iterating on Immunefi Studio.
But from the whitehat side, this flow feels pretty broken.
Especially when it costs $95 to get to this outcome.
Small @immunefi ask:
When a report is closed as "Duplicate of invalid", show why the original was rejected as invalid.
Right now we only see the original report, NOT the closure reason.
It feels like basic courtesy when I paid 75 USDC to submit.
Offchain activities with my homies 🥩
The most elite whitehat team in existence. @Certora
It was an absolute pleasure having @SagivMooly and part of the team visit for ETHSofia.
Until next year.
@MartinMarchev @p_tsanev @arabadzhiev_ @nmirchev8 @0xnovaman33 @0xlemonaudits @xb0g0 @valuevalk @s4muraii77 @neumoXX @santipu_ @zhivkoto @zarkk01 @ilchovski98
Martin Marchev retweeted
FIRST BID ON A NEW SPOT!!!! 🔥 by @MartinMarchev
who wants to brand the magic mouse now???
Brand my Mac... even MORE
→ 10 new sticker spots: inside + accessories
→ bid from $46
→ 7 days left
new chance to get your brand on the MacBook that got 10M+ views and started a whole trend 😎
BrandMyMac.com
I did a bit of web2 hunting lately, mostly on viral indie hacker launches.
It's refreshing to change the lens a bit after years of web3 security.
I found a High in BrandMyMac.com.
Disclosed it to @VynseDev.
The fix was live before I finished my coffee.
I love that energy in the indie hacker community 🔥
📢 Big shoutout to @MartinMarchev for helping me improve the website's security 📢
he did an amazing job, testing thoroughly, sending super clear and detailed reports...
very helpful, I highly recommend if you need a security review! 👌🏼
I am a simple man.
I see an em dash. I stop reading.
Saved myself 400 hours of "let's delve into" this year alone.
